CVE-2026-80775

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

futex: Fix race on the initial mm->futex.phash.ref allocation

futex_hash_allocate() allocates mm->futex.phash.ref without any locking.

Commit d9b05321e21e ("futex: Move futex_hash_free() back to __mmput()")

moved the allocation here and assumed that the process has just a single

thread at this point.

Commit ee9dce44362b ("futex: Drop CLONE_THREAD requirement for private

default hash alloc") widened need_futex_hash_allocate_default() to cover

any CLONE_VM clone, but left out vfork because the parent is suspended and

cannot race.

That no longer holds once vfork is nested. If a vfork child calls vfork

again and is then killed with SIGKILL, the parent is released from its

vfork wait and runs concurrently with the grandchild in the same mm.

Neither of them went through futex_hash_allocate_default().

When both call prctl(PR_FUTEX_HASH, PR_FUTEX_HASH_SET_SLOTS) at the same

time, each one sees mm->futex.phash.ref as NULL

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References